CVE-2026-46856 Oracle Corporation CVE debrief

Who should care

Administrators and users of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 should be aware of this vulnerability and take necessary precautions to defend against it. This includes reviewing the official advisory, assessing exposure, and applying patches or mitigations as needed.

Technical summary

The vulnerability, located in the Metadata Plugin component of Oracle Enterprise Manager Base Platform, has a CVSS 3.1 Base Score of 9.6, indicating a high severity level. It can result in confidentiality, integrity, and availability impacts. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The vulnerability affects Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Administrators and users should review the official advisory, assess exposure, and apply patches or mitigations as needed to defend against this critical vulnerability.

Defensive priority

High

Recommended defensive actions

• Apply the vendor-provided patch
• Restrict access to the affected component
• Monitor for suspicious activity
• Implement additional security controls
• Verify and update inventory
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-06-17T10:54:03.220Z and was last modified on 2026-06-18T04:16:49.747Z. The NVD entry is currently Analyzed. The vulnerability is in Oracle Enterprise Manager Base Platform, specifically in the Metadata Plugin component. Evidence is based on CVE.org and NVD details. Defenders should verify affected product deployments and review official advisories.

Official resources